Attorney Docket No. 275 12U 
Preliminary Amendment 

AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application. 

Listing of Claims : 
1-38 (Cancelled) 

39. (Previously presented) An apparatus configured to monitor and audit activity in a network, 
the network utilizes an incremental protocol, the apparatus comprising: 

a) an analyzer operative to analyze intercepted packets conveyed by entities in the network 
and to generate analyzed data based on information associated with at least some of said 
packets, the analyzed data being indicative of sessions; 

b) a mirror manager responsive to said analyzed data for generating mirror data 
representative of mirror sessions, each mirror session corresponding to one of said 
sessions; and 

c) an audit event analyzer being responsive to said mirror data for generating event data 
representative of inbound audit events and outbound audit events, said event data 
including characteristics relating to at least on-screen field location of data being part of 
the inbound audit events and outbound audit events, said audit event analyzer being 
adapted to analyze said event data for extracting extracted data from event data 
representative of an inbound audit event together with the characteristics respective of 
said inbound audit event, and to generate event data representative of a united audit 
event by combining the extracted data with one or more fields in event data 
representative of an outbound audit event based on said characteristics, 

40. (Previously presented) The apparatus of Claim 39, further comprising: 

a business event analyzer for processing at least part of said event data representative of 
outbound, inbound and united audit events and generating data representative of business events. 
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4 1 . (Previously presented) The apparatus of Claim 40, further comprising: 

an alerts manager coupled to the business event analyzer and being responsive to said data 
representative of business events for generating alerts. 

42. (Previously presented) The apparatus of Claim 4 1 , wherein the alerts manager is configured 
to generate at least some of the alerts based on predetermined thresholds. 

43. (Previously presented) The apparatus of Claim 39, further comprising: 

a first long term storage device for storing at least part of said analyzed data. 

44. (Previously presented) The apparatus of Claim 39, finther comprising: 

a second long term storage device for storing at least part of said mirror data representative 
of mirror sessions. 

45. (Previously presented) The apparatus of Claim 39, further comprising: 

a compression agent for compressing at least part of the mirror data representative of 
mirror sessions. 

46. (Previously presented) The apparatus of Claim 39, further comprising: 

an encryption agent for encrypting at least part of the mirror data representative of mirror 
sessions, 

47. (Previously presented) The apparatus of Claim 39, flirther comprising: 

a signature agent for digitally signing at least part of the mirror data representative of 
mirror sessions. 
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48. (Previously presented) A method of monitoring and auditing activity in a network, the 
network utilizes an incremental protocol, the method comprising: 

a) analyzing intercepted packets conveyed by entities in the network; 

b) generating analyzed data based on information associated with at least some of said 
packets, the analyzed data being indicative of sessions; 

c) responsive to said analyzed data generating in respect of one or more of said sessions 
mirror data representative of one or more mirror sessions, each mirror session 
corresponding to a session; and 

d) generating event data representative of inboxmd audit events and outbound audit events, 
said event data including characteristics relating to at least on-screen field location of 
data being part of the inbound audit events and outbound audit events; 

e) extracting extracted data from event data representative of an uibound audit event 
together with the characteristics respective of said inbound audit event; and 

f) generating event data representative of a united audit event by combining the extracted 
data with one or more fields in event data representative of an outbound audit event 
based on said characteristics. 

49. (Previously presented) The method of Claim 48, further comprising: 

processing at least part of said event data representative of outbound, inbound and united 
audit events and generating data representative of business events. 

50. (Currently amended) The method of Claim [[0]] 49, ftirther comprising: 

responsive to said data representative of business events generating alerts in respect of at 
least one of said business events. 

5 1 . (Previously presented) The method of Claim 5 0, wherein generating at least some of the alerts 
is based on predetermined thresholds. 
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52. (Previously presented) The method of Claim 48, further comprising: 
storing at least part of the analyzed data. 

53. (Previously presented) The method of Claim 48, further comprising: 
storing at least part of the mirror data representative of mirror sessions. 

54. (Previously presented) The method of Claim 48, further comprising; 
compressing at least part of said mirror data representative of mirror sessions. 

55. (Previously presented) The method of Claim 48, further comprising: 
encrypting at least part of said mirror data representative of mirror sessions. 

56. (Previously presented) The method of Claim 48, further comprising: 

digitally signing at le^t part of said mirror data representative of mirror sessions. 

57. (Cancelled) 

58. (Previously presented) A computer program product comprising a computer useable 
medium having computer readable program code embodied therein for performing steps of claim 
48. 

59. (Previously presented) The apparatus of claim 39, further comprising: 

a terminal responsive to said event data representative of a united audit event for 
displaying said united audit event without requiring that preceding outboxmd and inbound audit 
events be displayed prior thereto. 
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